1757 matches found
JupyterLab 安全漏洞
JupyterLab is a JupyterLab open source extensible environment for interactive and repeatable computation, based on the Jupyter Notebook and architecture. A security vulnerability exists in JupyterLab that originates from opening a malicious notebook or Markdown file with Markdown cells using the...
Security update for python-notebook (moderate)
openSUSE Security Update: Security update for python-notebook Announcement ID: openSUSE-SU-2024:0231-1 Rating: moderate References: 1227583 Cross-References: CVE-2019-11358 CVE-2021-32798 CVSS scores: CVE-2019-11358 NVD : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-32798 NVD : 9.6...
CVE-2024-25633
CVE-2024-25633 affects eLabFTW, where versions 4.4.0 up to (and not including) 5.0.0 allow regular users to create new, validated accounts within their team. If anonymous access is enabled, unauthenticated users can create accounts in any team. The issue was fixed starting with version 5.0.0 (Feb...
OPENSUSE-SU-2024:0231-1 Security update for python-notebook
This update for python-notebook fixes the following issues: - Update to 5.7.11 sanitizer fix CVE-2021-32798 boo1227583 - Update to 5.7.10 no upstream changelog - Update to 5.7.9 Update JQuery dependency to version 3.4.1 to fix security vulnerability CVE-2019-11358 Update from preact to React...
CVE-2024-38354
CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe HTML tags with an improperly sanitized name attribute. This vulnerability enables attackers to perform cross-site scripting XSS attacks via DOM clobbering. This...
SUSE CVE-2021-32798
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim...
CVE-2024-38354: Improper Neutralization of Input During Web Page Generation
CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe HTML tags with an improperly sanitized name attribute. This vulnerability enables attackers to perform cross-site scripting XSS attacks via DOM clobbering. This...
OPENSUSE-SU-2024:10377-1 python3-jupyter_notebook-4.2.3-1.1 on GA media
These are all security issues fixed in the python3-jupyternotebook-4.2.3-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:11242-1 jupyter-notebook-6.2.0-1.4 on GA media
These are all security issues fixed in the jupyter-notebook-6.2.0-1.4 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:12148-1 jupyter-notebook-6.4.12-1.1 on GA media
These are all security issues fixed in the jupyter-notebook-6.4.12-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:13606-1 jupyter-notebook-7.0.7-1.1 on GA media
These are all security issues fixed in the jupyter-notebook-7.0.7-1.1 package on the GA media of openSUSE Tumbleweed...
VSCode ipynb Remote Code Execution Exploit
VSCode when opening a Jupyter notebook .ipynb file bypasses the trust model. On versions v1.4.0 through v1.71.1, its possible for the Jupyter notebook to embed HTML and javascript, which can then open new terminal windows within VSCode. Each of these new windows can then execute arbitrary code at...
VSCode ipynb Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VSCode ipynb Remote Development RCE', 'Description' = %q VSCode when opening an Jupyter notebook .ipynb file bypasses the trust model. On version...
SUSE CVE-2021-32797
JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn't sanitize the action attribute of html . Using this it is possible to trigger the form...
CVE-2024-31865
Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version...
CVE-2024-31865
Apache Zeppelin (versions 0.8.2 before 0.11.1 ) is vulnerable to an Improper Input Validation flaw. An attacker can call the updating cron API using invalid or improper privileges, which allows a notebook to run with the elevated privileges of the user associated with the cron job. This could lea...
CVE-2024-31865
Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version...
CVE-2024-31863 Apache Zeppelin: Replacing other users notebook, bypassing any permissions
Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...
CVE-2024-31863 Apache Zeppelin: Replacing other users notebook, bypassing any permissions
Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...